[Nexus 6P Android Development] npjohnson:
Recent CM Theme Engine Commits seem to have subdued the issue. I use PureNexus Layers as Primary, with Domination Black Out theme as a /vendor overlay, and secondarily boot CM13 and PureNexus-CMTE with no issues whatsoever.

The only issue I have noticed is that if you have multiple Layers ROMs, they must all share the same theme.

I have plans to add virtual /vendor support when I get time, but life has been pretty busy. I neglected some of my other projects in favor of this over the last week, and am carving out this weekend to get those up to date. Then I'll get back to the virtual /vendor implementation.

No, FingerPrint authentication is much more complicated, see below.

No. There is none. See blow.

All,

The fingerprint issue isn't really a bug as much as it is an expected behavior. Google opted to have Nexus Imprint report/verify all fingerprint authentications through TrustZone (Qualcom's Secure World Kernel). This means that the fingerprint authentication is (almost) imperceptible in terms of input, meaning one could not send a virtual fingerprint via a simple software exploit (like a sandbox escape, root access shell, or even kernel exploit), making it a whole new level of secure.

In order to explain why Imprint is no likely to ever work on Secondary ROM's. you will need some background info; GateKeeper is the process that manages fingerprint authentication, and it (seems to me) to make an SMC call to the kernel (that must be verified and signed off by the kernel), which then in turn sends an SCM (Secure SMC) call to the TrustZone kernel to authorize/deny the fingerprint, and returns a verified or unverified status, which the kernel sends back to GateKeeper (some unnamed subfunction of GateKeeper, actually), which unlocks the device or sends the "failure" message.

Now, why does it not work on Secondary ROM's? Shouldn't they be interacting with TrustZone the same way the Primary ROM would?

Yes. Yes it should, however, what has happened is that some MultiROM function (probably the virtual Boot Image if I had to guess) is causing the kernel to sign off and send the SCM to TrustZone, which is then saying something like "this syntax is wrong/this is unverified because of x reason" and then is denying the fingerprint. For some reason, that special failed verification causes you to get locked out of your primary ROM (probably because TZ looks at the Secondary ROM's *.key files, and is like "wtf, these haven't been logged as securely changed, and yet, they aren't what I remember them being, denied." and then locks you out, and is looking for a key that doesn't exist.

So, TrustZone is doing its job! It's just doing it a little to well. There is little to no hope of fixing this issue honestly. TrustZone isn't exactly verbose about it's actions, and retrieving TrustZones internal logs requires UART (doable, and will test Headphone jack UART soon), or a TrustZone exploit, which I can only count 2 that have ever applied to Nexus device chipsets, and the newer models have even less of a chance.

To add, even if we knew EXACTLY WHY TrustZone is denying us, it would likely be unfixable without the ability to execute code as TrustZone, which is EXTREMELY UNLIKELY, as those exploits are worth quite a bit for research, and in the monetary sense.

Tl;DR: Somewhere along the line, MultiROM breaks the Secure Chain of Trust, and causes you to permanently get locked out of Secondaries, as well as your Primary. So, we opted to use MultiROM to block the function that sends the calls to the kernel to prevent accidental lockouts, which is what makes the fingerprint enrollment crash on Secondary ROM's.

I will be making a developers disscussion thread soon to discuss this issue, but as I said, I would bet that this will never be fixed.

If anyone wants to test my only hypothesis, build MultiROM without virtual boot image support, reenable GateKeeper, and have your ROM's share the same kernel and find a way to make sure that all three ROM's /data/system/*.key files are identical (this part may be impossible, I would have no clue how to get the ROM's to all accept these). If that allows you to enroll a finger and not get locked out, report it. I will not be doing test builds for this purpose in the near future (maybe never), as it would be A LOT of work on nothing but a hunch.